[Attacks and Exploits] A penetration tester is trying to get unauthorized access to a web application and executes the following command: GET…

The command shown is a classic example of a Directory Traversal (also known as Path Traversal) attack. The payload 2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd is a URL-encoded string. When decoded, %2e becomes . and %2f becomes /. The resulting string is ../../../../etc/passwd. The ../ sequence is used to navigate up the file system's directory structure. The attacker's goal is to move outside of the web server's root directory to access sensitive system files, in this case, /etc/passwd, by exploiting a lack of input sanitization on the id parameter.

A. Insecure Direct Object Reference: This attack involves altering a parameter that directly references an object (e.g., changing ?userid=100 to ?userid=101), not manipulating the file path with ../ sequences.

B. Cross-Site Request Forgery: This is an attack that forces an end user to execute unwanted actions on a web application in which they are currently authenticated; it does not involve direct file path manipulation by the attacker.

D. Local File Inclusion: While directory traversal is a technique used to achieve LFI, LFI specifically refers to the vulnerability where an application includes and processes a file. The attack shown is the traversal technique itself, which is the most accurate description of the payload.

1. OWASP Foundation. (2020). Path Traversal Cheat Sheet. OWASP Cheat Sheet Series. Retrieved from https://cheatsheetseries.owasp.org/cheatsheets/PathTraversalCheatSheet.html. The document explicitly defines Path Traversal as an attack that "allows an attacker to read arbitrary files on the server" and provides examples like ../../../etc/passwd and its URL-encoded variants.

2. MITRE Corporation. (2023). CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Common Weakness Enumeration. Retrieved from https://cwe.mitre.org/data/definitions/22.html. This official standard describes the weakness where software uses external input to construct a pathname but fails to neutralize special elements like .. allowing access outside the intended directory.

3. Boneh

D.

& Grossman

D. (2018). CS 155: Computer and Network Security

Lecture 7: Web Security Model. Stanford University. Slide 39

"Path Traversal

" illustrates this exact attack vector

showing how an attacker can use ../ to construct a path to /etc/passwd.